Age UK Norwich offers a wide range of services, ranging from groups and clubs to advice on financial matters. To provide our services, we need information about you. 
 
By “information” we mean the personal, financial and health information about you that we collect, use, share and store. 
 
The information we hold will vary according to the service you use and what you have asked us to do. For example, the information we need for lunch club membership is minimal, in comparison to technical services such as dementia care or welfare advice. 
 
Each of our services has a Privacy Notice explaining the information we collect, how we use it and who we may share it with. This is provided as part of the service sign-up process. We will ask for you to acknowledge your understanding of how we use your information and get your consent to collecting, using and sharing your information.

Why we need the information and what we use it for

Data Protection law requires us to have one or more of the following reasons for using your information. We will explain how we use your information in the Privacy Notice provided when you sign up for a service with us.   
 
1. 'Contract performance' – the information needed to deliver the service or product, e.g. we’ll need to hold your financial status to advise you on means-tested welfare rights. 
 
2. 'Legal obligation' – we are required by law to process your information, e.g. to verify your identity or for safeguarding. 
 
3. 'Legitimate interest' – we’re allowed to use your information where, on balance, the benefits of us doing so are legitimate and not outweighed by your interests or legal rights. 
 
4. 'Consent' – in some cases we may obtain your consent to use information in a particular way or where the law requires consent to be obtained, e.g. recording something about your health.  Whenever ‘consent' is the only reason for us using the information you have the right to change your mind and change or withdraw your consent.
 
5. 'Vital Interest' – processing is necessary in order to protect the vital interests of the data subject or of another natural person. 

Using your information

These are the main ways we’ll use your personal information and the reasons for doing so:

1. Check your identity and eligibility for this service  (Contract performance; Legal obligation)
The law requires us to verify the identity of our clients. This is so we know who our clients are and to make it more difficult for criminals to obtain information about you. We will use your information to validate who you are when you call or visit us. We’ll also check that you meet the criteria to receive the service, which could be based on age, financial details or your health. 
 
2. Manage your relationships with us (Contract performance; Legal obligation)
We’ll use your information to manage the service, product or relationship you have with us, in line with the terms of that arrangement and the rules of our regulators and funding partners. 
 
Examples of this are sending you the information you have asked for, notifying you of changes to the status of your request, logistics for groups or 1-1 support, administering any surveys, evaluations or promotions you’ve agreed to participate in.  

3. Assessing risk (Contract performance; Legal obligation, Legitimate Interest)
We have a legal obligation to share information with our local authorities, law enforcement agencies or regulators in relation to our operational activity and any risks under adult safeguarding or fraud. In such cases, confidentiality will not be guaranteed. 
 
We have a legitimate interest to ensure our services are safe for you, our staff and volunteers. We may share your information with other organisations we partner with to make risk assessments or adjustments to activities.

4. Acknowledging donations, fees and financial records  (Legitimate interest, Legal Obligation)
We have a legitimate interest in acknowledging receipt of the donations and fees we receive. We have a legal obligation to validate the source of charity funds and retain appropriate financial records for compliance to accounting standards and HMRC gift aid rules.  
 
5. Recover money that is owed to us (Contract performance; Legitimate interest)
If a service is chargeable, we have a legitimate interest in recovering debts that are due to us if there isn’t a satisfactory plan in place to repay them. We may instruct a debt collection agent or solicitor to act for us in recovering the debt and we’ll provide relevant information to them to help recover any money that is owed to us.

6. Identify other products and services that you may find useful (Legitimate interest; Consent)
The range of products and services we offer is constantly evolving. We will use your information to identify related services that we think would interest or benefit you.  
 
We will only tell you about this if we have your explicit consent to do so and we will only send it to you in the manner you have asked. You have a legal right to tell us at any time that you don’t want us to use the information we hold in this way or to withdraw any consent that you have given to us.
 
How is your information stored and processed

Information is captured, stored and processed in paperwork and/or online via our customer management system. If applicable, paper records are stored while we are working on your case and then digitalised and archived for the period we need to keep them. 
 
All records are stored securely, and access is limited to staff and volunteers with express permission only.  
 
Who we share information with
 
As a Data Owner, Age UK Norwich uses a number of organisations to process information and data through the use of the technology we use. These are known as Data Processors. The Data Processors we use will vary depending on the service or product. 

Information is shared securely with each data processor through the access and use of their software functionality, online storage or facilities. No client information is shared for any other purposes. 

 
To provide a service to you, we may share you information with other organisations. Your service Privacy Notice(s) will tell you if there are any organisations we share data with and why.

How long we hold information

We’ll retain information for no longer than is necessary to manage your relationship with us. While you still actively use our service(s), we will keep your information. We will continue to hold some information for a period of time after your relationship has ended. This is encase you change your mind, or to comply with our legal and regulatory obligations to keep records of our relationship, to resolve disputes or where it may be needed for future legal proceedings. 

Your legal rights in relation to your information 

The law guarantees you rights in relation to your personal information. We have set out details of your rights below under individual headings.

Access to information

You have the right to ask if we hold information about you, and if we do, what the information is, how it is held and the ways we are using it. You’re also entitled to a copy of the information.

Rectification of information

We always want the information we hold to be up to date and accurate. If any of the information we hold is either incorrect or out of date, then please tell us and we’ll fix it.

Erasure of information

You have the right to ask us to erase or delete information where you consider there is no longer any justification for us holding it, either because: 

• The information is no longer needed for the reason we collected it.
• We held and used the information based only on your consent, which you have now withdrawn.
• You have previously objected to a way in which we use information.
• We have been using the information unlawfully.
• There is a legal obligation on us to erase the information.

When you make a request for information to be erased we’ll have up to one month to respond. If we reject your request, we will tell you and set out the reasons why we’ll not erase or delete the information.

Portability of information

You have the right to get some of your information that you provided from us in a machinereadable format.

Objecting to us using your information

Your service Privacy Notice(s) will tell you the information we collect, how it is stored and who we share it with. 

Where we have told you that any use of information is based on ‘legitimate interest’, you can raise an objection to that use. When you make an objection, we’ll have up to one month to respond to you. We will stop using the information in this way unless we disagree that we should because of a compelling legal justification for continuing to use it. We’ll always tell you what the justification is.

Remember, you can always simply opt out of receiving our magazine, Citywide or our other marketing communications at any time. You can do this by contacting us in the usual way.

Restricting some uses of information.

In certain circumstances you have a right to block or limit the use of information by us. This may arise where: 

• You have challenged the accuracy of the information we hold, and we are verifying this.
• You have objected to a use of information (see above) and we are considering whether your objection is valid.
• We have been using your information unlawfully, but you want us to continue to hold the information rather than erase it. (See Erasure of information)
• We no longer need to keep the information, but you have asked us to hold it because of legal claims you’re involved in.

Contacting us for further Information about your rights

You can contact us at any time and in the normal way to discuss how Age UK Norwich holds and uses your information and your rights.

You can also contact our Data Protection Lead for further information and to request to use these rights. 

You can contact our Data Protection Lead:  via telephone 01603 496333. Or email caldicott@ageuknorwich.org.uk

Our email disclaimer

Who can I complain to?
In the first instance, please contact us so that we can understand your issue and try and resolve it. We may ask our Data Protection Lead to look at your situation. 

If we can’t resolve the issue you have the right to complain to the Information Commissioners Office (ICO). The ICO is the UK's independent body set up to uphold information rights. For further information visit www.ico.org.uk quoting Age UK Norwich’s ICO registration number - Z8127799